Fix Cosmos' QueryItems silently parsing non-success responses as data

[vcolin7]

What does this PR do?

CosmosService.QueryItems read each page from the query stream iterator (Container.GetItemQueryStreamIterator, a FeedIterator) and parsed ResponseMessage.Content without first checking the HTTP status. The stream iterator surfaces non-success responses (throttled 429, auth-failure 403, unavailable 503) as a non-success ResponseMessage rather than throwing, so the error JSON body was silently cloned into the result set and returned to the caller as if it were data.

The fix adds a response.EnsureSuccessStatusCode(); guard immediately after ReadNextAsync and before JsonDocument.Parse, so a non-success page throws a CosmosException instead of being parsed as data. This matches the existing convention already used by ListDatabases and ListContainers in the same file, which guard their stream responses the same way.

GitHub issue number?

Fixes #432

Pre-merge Checklist

• Required for All PRs

  • Read contribution guidelines
  • PR title clearly describes the change
  • Commit history is clean with descriptive messages (cleanup guide)
  • Added comprehensive tests for new/modified functionality
  • Created a changelog entry if the change falls among the following: new feature, bug fix, UI/UX update, breaking change, or updated dependencies. Follow the changelog entry guide

• For MCP tool changes:

  • One tool per PR: This PR adds or modifies only one MCP tool for faster review cycles
  • Updated servers/Azure.Mcp.Server/README.md and/or servers/Fabric.Mcp.Server/README.md documentation
  • Validate README.md changes running the script ./eng/scripts/Process-PackageReadMe.ps1. See Package README
  • For new or modified tool descriptions, ran ToolDescriptionEvaluator and obtained a score of 0.4 or more and a top 3 ranking for all related test prompts
  • For tools with new names, including new tools or renamed tools, update consolidated-tools.json
  • For renamed tools, follow the Tool Rename Checklist and tag the PR with the breaking-change label
  • For new tools associated with Azure services or publicly available tools/APIs/products, add URL to documentation in the PR description

  N/A - internal data-correctness bug fix. No tool was added, renamed, or had its description, name, or options changed, so the tool-surface, README, consolidated-tools.json, and ToolDescriptionEvaluator items do not apply.

• Extra steps for Azure MCP Server tool changes:

  • Updated command list in servers/Azure.Mcp.Server/docs/azmcp-commands.md
  • Ran ./eng/scripts/Update-AzCommandsMetadata.ps1 to update tool metadata in azmcp-commands.md (required for CI)
  • Updated test prompts in servers/Azure.Mcp.Server/docs/e2eTestPrompts.md

  N/A - no command surface or metadata changed.

Invoking Livetests

Copilot submitted PRs are not trustworthy by default. Users with write access to the repo need to validate the contents of this PR before leaving a comment with the text /azp run mcp - pullrequest - live. This will trigger the necessary livetest workflows to complete required validation.

[Copilot]

Pull request overview

This PR fixes a data-correctness bug in the Cosmos tool where CosmosService.QueryItems could silently parse non-success ResponseMessage bodies (e.g., 403/429/503 error payloads) as if they were query results. The change aligns QueryItems with the existing stream-response handling pattern already used by other CosmosService methods.

Changes:

• Add response.EnsureSuccessStatusCode() immediately after ReadNextAsync in CosmosService.QueryItems to ensure non-success pages throw instead of being parsed as data.
• Add a regression test asserting QueryItems throws on non-success responses.
• Add an Azure.Mcp.Server changelog entry documenting the fix.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tools/Azure.Mcp.Tools.Cosmos/src/Services/CosmosService.cs	Validates stream query page HTTP status before parsing JSON to prevent error payloads being treated as data.
tools/Azure.Mcp.Tools.Cosmos/tests/Azure.Mcp.Tools.Cosmos.Tests/CosmosServiceTests.cs	Adds regression coverage ensuring QueryItems throws CosmosException on non-success responses.
servers/Azure.Mcp.Server/changelog-entries/1780624204134.yaml	Documents the Cosmos QueryItems non-success parsing bug fix in the server changelog entry format.